Cisco Updated 300-420 Exam Questions and Answers by alina

The Cisco SD-WAN architecture mapping follows the standard controller and edge roles. WAN Edge devices are the data-plane routers that forward user traffic, build secure IPsec tunnels, participate in local routing, and apply QoS and security policies at sites. vSmart controllers provide the centralized control plane. They maintain overlay routing and policy information and distribute it to WAN Edge routers through OMP. vBond orchestrators provide the initial orchestration function, including device authentication assistance, control connection coordination, and NAT traversal support so devices can join the overlay. Depending on the exact drag-and-drop labels in the exhibit, the selected mapping assigns each element to its architectural function rather than to a deployment location. The important design principle is that vManage, vSmart, vBond, and WAN Edge have separate responsibilities and should be scaled and secured accordingly. vManage manages and monitors, vSmart controls routing and policy, vBond helps devices join and traverse NAT, and WAN Edge forwards traffic. Reference topics: Cisco SD-WAN architecture, WAN Edge, vSmart, vBond, OMP, control and data plane separation.

The Cisco SD-Access fabric control-plane node requires the LISP Map-Resolver and Map-Server functions. In SD-Access, fabric edge nodes register locally attached endpoints with the control-plane node, and other fabric nodes query the control plane when they need to locate a destination endpoint. The Map-Server stores Endpoint Identifier to Routing Locator bindings, while the Map-Resolver resolves lookup requests and returns mapping information so the source edge node can encapsulate traffic toward the correct remote fabric node. Ingress Tunnel Router and Egress Tunnel Router roles are performed by fabric edge or border nodes that encapsulate and decapsulate user traffic, not by the dedicated control-plane function. The option labeled Map-Server Proxy reflects the map-server role used in the answer set, while the Map-Resolver is explicitly required. This separation lets SD-Access provide host mobility, anycast gateway behavior, and scalable endpoint reachability without flooding. Reference topics: Cisco SD-Access control plane, LISP, Map-Server, Map-Resolver, EID-to-RLOC mapping, fabric edge registration.

Out-of-band Ethernet is the correct management design for a large data center when the customer wants device grouping, management-plane isolation, and reduced blast radius from compromise. In an out-of-band design, management traffic uses a physically or logically separate management network instead of traversing the production data plane. This allows different device classes to be placed into management zones, protected by access control, authentication, logging, and rate-limiting policies. If one managed device is compromised, the attacker should not automatically gain production network reachability through the management interface. In-band Ethernet would share the production infrastructure and therefore would not provide the same isolation. Dial-up out-of-band access can be useful for emergency console access, but it is not appropriate as the primary management architecture for a large data center. Out-of-band Ethernet provides scale, speed, and segmentation while still allowing centralized management systems to reach routers, switches, controllers, and appliances. Reference topics: out-of-band management, management-plane security, data-center operations, isolation, access control, DoS mitigation.

The vSmart controller provides the centralized control plane in a Cisco SD-WAN deployment. It establishes secure control connections with WAN Edge routers and exchanges routing, topology, security, and policy information using OMP. The vSmart controller does not forward user data traffic; data-plane forwarding occurs directly between WAN Edge routers over IPsec or other supported encapsulations. Its function is to distribute reachability information, TLOC information, service routes, centralized policies, application-aware routing policies, and segmentation information that determines how the overlay operates. vBond orchestrates onboarding, authentication facilitation, and NAT traversal for control connections. vManage provides centralized management, monitoring, configuration templates, and operational GUI/API functions. vEdge or Cisco IOS XE SD-WAN routers provide the branch or site data plane and local routing functions. Therefore, among the choices, the vSmart controller is responsible for the centralized control plane of the SD-WAN network. Correctly separating orchestration, management, control, and data-plane roles is a core Cisco SD-WAN design principle.